This vulnerability exists in the tftp-hpa package's in.tftpd remap engine when processing inverse remap rules that abort with a non-empty custom error message. Invalid match offsets are passed to the genmatchstring() function, leading to out-of-bounds read/write operations. A remote attacker can trigger a daemon crash by sending a specially crafted request, causing denial of service. Exploitation requires the tftp daemon to be configured with filename remapping enabled via the m/-map-file option and specific inverse (~) and abort (a) rules with custom error messages. The flaw does not affect default configurations and is limited to setups using these remap features.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing the in.tftpd daemon. There is no impact on confidentiality or integrity under default configurations. However, the out-of-bounds read could potentially leak memory contents, which might aid in bypassing protection mechanisms like ASLR in other attack scenarios. The impact is limited by the requirement for a non-default configuration enabling filename remapping with specific remap rules.

Red Hat advises avoiding enabling filename remapping with the m/-map-file option for the in.tftpd service unless strictly necessary. If filename remapping is required, ensure that inverse (~) and abort (a) rules in the remap file do not include non-empty custom error messages. Any configuration changes require restarting the in.tftpd service to take effect. No official patch is explicitly stated in the advisory; thus, patch status is not yet confirmed—check the vendor advisory for updates.